Privacy

What WillowMap stores

You can use WillowMap without an account — your maps and pins are stored in our database and identified by a server-issued cookie, and we do not ask for an email, name, or password.

Signing in is optional and lets you keep your conversations across devices. We offer Google sign-in and email (magic-link) sign-in — either way, we store your email address and, for Google, the name and profile photo Google shares with us. We do not require this to use WillowMap for your own maps.

Your browser also keeps a local list of recent search and AI queries (under willowmap:history:v1 in localStorage) so you can re-run them quickly. Older entries are pruned automatically as the app loads, and you can clear the list at any time from the recent-queries panel.

During the private beta, usage analytics is on for everyone by default and there is no consent banner. WillowMap is early software and this data is what tells us which parts of it are broken. You can turn it off for your browser at any time in Settings, and consent gating will return before public launch. Details of what is collected are in the two sections below.

WillowMap records a small set of first-party usage events in its own database: places displayed in Explore results (their rank and truthful photo-fallback presentation tier), whether an available video qualified for hero or secondary placement, successful place saves, and opens of directions. We do not include search text, place names, map IDs, precise coordinates, or user-authored content in analytics events.

These first-party events use a random session ID stored in your browser. It is pseudonymous and is not your account ID; WillowMap does not attach an account ID even when you are signed in. When an event needs location context, latitude and longitude are rounded to 0.1° on the device and checked and rounded again by the server. They are pruned periodically rather than kept indefinitely; in this initial release an owner does that with a manual database cleanup, rather than an automatic expiry job, so we are not quoting a fixed period for it here.

Your browser also stores a random device ID (under willowmap:device-id:v1 in localStorage). It is not linked to an account and is never used for advertising. Two things use it: deciding whether enough separate devices have looked at an uncurated area to justify researching it, and counting engagement per place (described below). Clearing site data clears it.

Third parties contacted on page load

• Vercel hosts the app. Standard request logs (IP, user agent, path) are kept for operational purposes.
• OpenFreeMap serves the base map tiles. Tile requests are made directly from your browser; no API key is required.
• OpenStreetMap (Overpass API) answers “Show me what's here”. Only when you press that button, the map area you are looking at is sent from WillowMap's server to overpass-api.de, operated by the OpenStreetMap Foundation in Germany. Your browser does not contact it directly, and nothing about you is sent — only the rectangle. Place data returned is © OpenStreetMap contributors, available under the Open Database License.
• Google Maps Platform (Places) powers search, autocomplete, and place details. All Places traffic is proxied through WillowMap's own server (/api/places/*) — your browser does not contact googleapis.com directly, and no Google API key is exposed to the client. Reverse-geocode calls round the viewport center to ~110 m before they leave your device.
• Anthropic handles AI search. Your prompt is sent server-side from WillowMap; we do not pass identifiers.
• PostHog (PostHog Inc., US Cloud) receives product analytics. Your browser sends these events to WillowMap's own origin (/ingest/*), which forwards them — your browser never contacts a posthog.com address directly. See “Product analytics” below for exactly what is and is not in them.
• Google (Sign-In) and Resend (email delivery) are contacted only if you choose to sign in — Google for Google sign-in, Resend to deliver a magic-link email. Neither is contacted otherwise.

Fonts and icons

Material Symbols (the icon font) and Inter (the UI font) are self-hosted from WillowMap's own origin. Your browser does not contact fonts.googleapis.com or fonts.gstatic.com.

Cookies

WillowMap uses one HTTP-only cookie to keep your maps editable across sessions on the same browser. Analytics uses localStorage rather than an analytics cookie — this is true of the product analytics described below as well, which is configured to store its identifier in localStorage rather than set one. WillowMap does not use advertising cookies.

Product analytics (PostHog)

Who receives it. PostHog Inc., on their US Cloud. Events are sent to WillowMap's own origin and forwarded from there, so your browser never resolves a PostHog hostname.

What is collected. Page views (with the URL reduced to a route shape — see below), and a fixed, closed list of product events: opening, closing, saving and getting directions to a place; opening and swiping through videos; pressing “Show me what's here” and how each stage of it went; how long the first nearby places took to appear; and app start. Alongside these, PostHog receives standard web context (browser, operating system, screen size, language, time zone, referring site) and Core Web Vitals page-performance measurements. Your IP address is used to derive an approximate country, which is stored.

What is not collected. No search text, no AI prompts, no place names, no map names, no share tokens, no coordinates of any precision, and no user-authored content. Times are sent as ranges (“3-10s”), never as exact durations. There is no session recording and no autocapture, so the text of things you click is never sent. No advertising or ad-network integration. No account ID, and no person profile is created — the events are not attached to a named individual on PostHog's side.

Share links are protected explicitly. An unlisted map's link contains a secret token. Before any page view leaves your browser, the address is rewritten to its shape (/:slug/:token) and the query string and fragment are removed entirely, so neither the token nor anything you typed into a search is included.

Retention. Product-analytics events are kept by PostHog and are not retained indefinitely by design, but we are not quoting a fixed period here while the beta settles — we would rather state none than state one we have not yet enforced end to end. These events carry no place IDs and no account IDs. You can opt out at any time in Settings, and you can ask us to delete what has already been collected — see the deletion note above.

Per-place engagement counts

WillowMap keeps a separate count of how often each suggested place is shown, opened and saved. These counts belong to the place, not to you: they are stored against the shared list of candidate places that everyone sees, in the same way as a place's category or its interest score. They are used to work out which suggestions are worth keeping in the list.

The random device ID described above is recorded with each daily count for one reason only: so that two hundred taps from one device can be told apart from two hundred taps from two hundred devices. A plain counter could not tell the difference and would be trivial to inflate. No session, no timestamp beyond the date, no location and nothing about you is stored alongside it, and these counts are not sent to PostHog or any other third party.

Analytics choice

You can turn analytics off for your browser at any time in Settings. Choosing “Do not allow” stops product analytics and the per-place engagement counts from that browser.

A tradeoff we are stating, not defending: collecting analytics from visitors in the EU and UK without asking first, and storing an identifier in localStorage, does not meet the consent requirements of the ePrivacy Directive or the GDPR. This is a deliberate, time-boxed private-beta decision, to be closed before public launch.

Operational error reporting is separate, consent-independent, and treated as essential to diagnosing failures and keeping the service reliable. A client error report can contain an allowlisted context, a bounded error message, the current path and query string, a timestamp, limited scalar diagnostic fields, and server-added user agent and referring-page headers. Error messages can sometimes contain unexpected data, so do not deliberately put private text in them. Reports are available to WillowMap owners in Vercel runtime logs and, when configured, Sentry. They are not used for product analytics or advertising.

Contact

Questions or deletion requests: hello@kiruna.ai.

To delete pseudonymous analytics, copy both IDs shown in Settings — the first-party analytics session ID and the product-analytics device ID — and include them in your request. An owner will remove the matching first-party rows and issue a deletion for the matching PostHog distinct ID, manually. Account and map deletion requests can use the same address.